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Decoy state method quantum key distribution (QKD) is one of the promising practical solutions to BB84 
QKD with coherent light pulses. In the real world, however, statistical fluctuations with the finite code length 
cannot be negligible, and the securities of theoretical and experimental researches of the decoy method state 
QKD so far are based on the asymptotic GLLP's formula which guarantees only that the limit of eavesdropper's 
information becomes zero as the code length approaches infinity. In this paper, we propose a substantially im- 
proved decoy state QKD in the framework of the finite code length and derive the upper bound of eavesdropper's 
information in the finite code length decoy state QKD with arbitrary number of decoy states of different inten- 
sities incorporating the finite statistics. We also show the performance of our decoy QKD and optimal values of 
parameters by numerical simulation. 
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I. INTRODUCTION 

Quantum key distribution (QKD) was originally proposed 
by Bennett and Brassard in 1984 yj] as a protocol, by which 
two parties, Alice and Bob, share secret keys by using a quan- 
tum communication channel as well as a public classical chan- 
nel 101. A remarkable feature is its unconditional security 
imBlS]; it is guaranteed by the fundamental laws of quantum 
mechanics and thereby QKD provides the unconditionally se- 
cure communication system. This is a triumph of quantum 
mechanics and quantum information science |0, Q] over the 
conventional cryptographic systems. In the practical setting of 
optical communication, however, it is the almost only option 
to substitute qubits in the original BB84 QKD protocol with 
heavily attenuated laser pulses because the perfect single pho- 
ton emitting devices are not available in the current technol- 
ogy. Such laser pulses - the phase randomized weak coherent 
states - contains inevitably the multi-photon states at small but 
finite probability, which gives a malicious eavesdropper (Eve) 
a chance to obtain some amount of information on the shared 
keys by a photon-number-splitting attack [8]. Gottesman-Lo- 
Lutkenhaus-Preskill (GLLP) showed, however, that it is still 
possible to obtain unconditionally secret key by BB84 proto- 
col with such imperfect light sources, although the key gener- 
ation rate and distances are very limited ^ . 

The recently proposed decoy state method [10, EH E3, E3] 
is one of the promising practical solutions to BB84 QKD with 
coherent light pulses, in which several coherent state pulses 
with different intensities are used. Such optical pulses with 
different intensities have different photon number statistics. 
This simple fact equips Alice and Bob with a countermeasure 
against Eve. The original idea of the decoy state QKD is due 
to Hwang 01 Oil . So far, several experimental demonstrations 
of decoy state QKD have been reported 111 [11 [H IT7L [H . 
In most cases, the security analysis is based on the GLLP's 
asymptotic arguments, whereas, in the practical setting, the 
code length is finite so that the asymptotic argument is no 
longer valid and the unconditional security is actually not 



guaranteed any more. The security analysis of QKD with 
the finite code size must incorporate the statistical fluctua- 
tions of the observed quantities [19]. Although several authors 
ifTTl [l3l [l5l I20I1 have considered the influence of statistical 
fluctuations on the decoy state QKD with finite code length, 
what all of them have done is limited to the re-adjustment of 
parameters of the asymptotic GLLP's formula. Such an ad 
hoc treatment cannot be justified to claim the unconditional 
security because the asymptotic GLLP's formula for the se- 
cure key generation rate provides us little knowledge about 
the eavesdropper's information when the finite code length is 
given. Therefore incorporating statistical fluctuations to the 
parameters of the asymptotic GLLP's formula cannot guar- 
antee the security of the QKD protocols with the finite code 
length even if values of these parameters are exactly known. 
Suppose that the asymptotic rate of sacrifice bits needed for 
the secure final private key is R. When the code length is n, 
assigning nR to the number of sacrifice bits cannot ensure how 
secure the final key is at all. Because the asymptotic argument 
can only guarantee that the limit of eavesdropper's informa- 
tion becomes zero when the rate of sacrifice bits is greater 
than R, and without the speed of the convergence the increas- 
ing amount of sacrifice bits from nR, which is needed for the 
secure key with the code length n, cannot be estimated. Thus 
we must consider statistical fluctuations to eavesdropper's in- 
formation formula with the finite code length n. Several upper 
bounds of eavesdropper's information with n have been pro- 
vided yl 13, 12H, and especially Hayashi's formula is simple 
and gives better key generation rate than the others, some pa- 
rameters of which cannot be directly obtained from observed 
quantities and are needed for estimation incorporating statis- 
tical fluctuations. 

In this paper, we propose a substantially improved de- 
coy state QKD in the framework of finite code length rf2lll 
by using the convex expansion formulas of weak coherent 
states 111 U ulll and derive an eavesdropper's information for- 
mula in the finite code length decoy state QKD with arbitrary 
number of decoy states of different intensities incorporating 
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the finite statistics. We also show the performance of our de- 
coy QKD and optimal values of parameters by numerical sim- 
ulation. 

The rest of this paper is organized as follows: In SectionlHl 
we begin by describing our decoy method QKD protocol. 
In Section [ill] we show Eve's information considering dark 
counts. We next explain how to estimate Eve's information in 
Section[lV]and random variables for describing the system in 
Section[V] followed by the estimation incorporating statistical 
fluctuations in Section |VT] We then demonstrate our numer- 
ical results of decoy method QKD protocol in Section I Villi 
and finally summarize our results and discuss future work in 
section HXl 



II. PROTOCOL 

First of all, we describe our protocol ll2"lll . We fix the size 
N of our code, the number N' of sent pulses, the maximum 
number N and the minimum number N_ of the size of a final 
key. We use k+ 1 different intensities or mean photon numbers 
po = < fi\ <...< fib including vacuum (/io) for the optical 
pulses. Two conjugate bases (+ and x) are treated separately 
so that 2k+ 1 different pulses are involved in total. The vacuum 
state (i = 0) is sent at the probability p () and the /i,- pulse with x 
(+) basis is sent at the probability p,- (p i+k ) (i = l,...,k). The 
pulse with the intensity fi io (pi 0+ k) (the signal pulse) is used 
to distill a final secret key and the remainings (decoy pulses) 
are used just for estimation of Eve's attacks and/or the noise 
characteristics of quantum channel. 

Before running the protocol, the probability p D of dark 
counts in the detector and the other (basis-dependent) system 
error probability ps (ps) of the x (+) basis are measured in 
advance. The probability p$ or p$ is the probability of errors 
other than the transmission errors, that is, the error probabil- 
ity for the noiseless channel. We assume that the detector is 
a threshold detector and the efficiency of the detector is inde- 
pendent of measurement bases 

The protocol is as follows. Alice randomly sends Bob a 
sequence of optical pulses of k + 1 different intensities with 
randomly chosen basis. After that, Bob performs a measure- 
ment in one of the two bases and they compare bases and keep 
the pulses with the common basis by communicating via pub- 
lic channel. The number of sending pulses, received pulses, 
and pulses of the common basis are denoted by, respectively, 
Aj, C„ and E t (i = 0, . . . , 2k). Note that J™* 1 A,- = N'. The 
Ej bit string of /th kind of pulse contains error bits, which will 
be detected by checking a portion of the bits (check bits). To 
prepare check bits, they firstly perform the random permuta- 
tion on Ej (l and Ei 0+ k bit strings by sharing common random 
numbers via public channel. Then, for i = ig and i = io + k, 
the first N bit string is used as the raw key and the remaining 
E-, a - N and E^+k - N bit string are used as the check bits, 
while the whole E, bits are used as check bits for i + io, io + k. 
(If E-, < N or Ei g+ k < N, then the protocol is aborted.) The 
number of detected errors of /th kind of pulse is denoted by //, 
(2 = 1, . . . , 2k). From these quantities, they can evaluate the 
size of the final key guaranteeing the unconditional security. 



If the evaluated final key size is not positive, the protocol is 
aborted again. The size of final secret key of + basis is com- 
puted as 

N fim i := Ntj{ Hio+k ) - m(Di, D e ), (1) 

and that of x basis is 

ft final := N?] f^%^j - mm, D e ), (2) 

where rj(-) denotes the error correcting coding rate and 
m(£>j,D e ) and ;«(£),,£)<,) represents the size of privacy am- 
plification. Here we abbreviate the initial data (A,fi, ps, po), 
{A,fi, ps, Pd) and the observed data (C,E,H) to £),, £),, and 
T> e , respectively, and A = (A\, . . . ,A2k), etc. If Nji„ a i < N_ 
or N fi na i < N_, they abort the protocol and go back to the 
first step. Furthermore, if N < A final (N < Nfi„ a i ), they 
replace m(Di,D e ) [m(pi,D e )] by Nr](H h+k /(Ei 0+k - AO) - N 
[Nj](H io /(E io - A 7 )) - N]. Finally, they are left with N bits er- 
ror correction followed by privacy amplification to share the 
A final (A final) bit secret key of + (x) basis. 

The error correction is performed as follows. Suppose that 
Alice and Bob have, respectively, the random number se- 
quences X and X' of N bits, which contain some errors. The 
task is to distill the common random number sequence of l+m 
bits with negligible errors. In the forward error correction, 
they share Nx(l + m) binary matrix M e . Alice generates other 
/ + m bits random number Z, and sends a bit sequence M e Z + X 
to Bob. Then, Bob applies the decoding of the code M e to the 
bit sequence M e Z + X - X' to extract Z. On the other hand, in 
the reverse error correction, Bob generates the random num- 
ber sequence Z of / + m bits, and sends M e Z + X' to Alice. 
Then, Alice applies the decoding code M e to the bit sequence 
M e Z + X' - X to extract Z. The error correction here corre- 
sponds to a part of the twirling operation so that their channel 
can be regarded as a Pauli channel from Alice (Bob) to Bob 
(Alice) in the forward (reverse) error correction Il2lll . 

In the privacy amplification, Alice and Bob share the final 
secret key of I bits from Z of / + m bits. More precisely, they 
first generate the same lx(l + m) binary matrix M p with 

Prob{Z e lmM T p } < (3) 

for any non-zero I + m bit sequence Z. Subsequently, they 
generate the bit sequence M p Z of / bits from Z of I + m bits. 

Combining the error correction and the privacy amplifica- 
tion described above, the sequel of it is that Alice sends infor- 
mation by the code lmM e / M e (KerM p ). 



III. GENERAL UPPER BOUND FOR EVE'S 
INFORMATION ON FINAL KEY 

In this section, we give an upper bound for the leakage in- 
formation on the final key, which lays the foundation of the 
security analysis in Sec.[Vl][2ll]. Here, we confine ourselves 
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to the discussion on the final key with + basis. Eve's at- 
tack can be described by the conditional distribution V of the 
Pauli action on the input state. Hence, the average of Eve's 
information with respect to the final key is closely related 
to the error probability P 9 . ... _ Dr . c with the minimum 

* J pn,mm.x\M p ,!D e ,POS 

distance decoding when information is sent with x basis and 
the code lmM e /M e (KerM p ), where POS is a random variable 
for the arrangement of different intensities and the position of 
check bits, and x =— > (<— ) refers to the forward (reverse) er- 
ror correction. The average P^ 

of Eve's information % x]Mp ^ ms 

1 ph,av,x ^M^D^POS 1 ph,mm,x\M,„D e ,POS as 



E,av,x J "Af p ,£) e ,POS £,^|Af p ,£) e ,POS 

is evaluated in terms of 



i E,av,x - r ph,av,x^ 1 +iv lu & r ph,av,x>- 



(4) 



Since the stochastic behavior of the random variables T) e de- 
pends on the conditional distribution f, we denote the opera- 
tion of taking the expectation with respect to M p , D e , POS by 
D pos . Denoting Eve's state with respect to the final key 

[Z] = M p Z by p^, and its average state by p E ' x , we obtain 
the following inequalities. 



2P 



[ZMZ'] 



P 

ph,av,x> 



^ rA , POS ^F(p^,p E - x )>l-2P[ 



p 

ph,av,x> 



and 



E M„A,POS m |X|^ X 



-P I 



Here, we have omitted the dependence of p^ on M p , D e , and 
POS. Next, let P^ UCCX \ M be the probability that Eve acquires 
perfectly information on the final key when she performs the 
optimal measurement after the privacy amplification. Then, 



(5) 
(6) 
(7) 

(8) 



fP P P 

J M,„D e ,POS succ,x\M p 



^ {JpZ, Jl - 2"^ + J\ - P 9 J^V 

V y ph,av,x y y ph,av,x y ) 



(9) 



,p 

succ,x\M p 



on 



Here, we have again omitted the dependence of P 
M p , T) e , and POS. Now, it is evident that the evaluation of 
P 9 h av x plays an essential role in the security analysis. 

We start by grouping detected pulses into six parts accord- 
ing to which state (vacuum, single photon, or multi-photon) is 
actually sent by Alice and whether or not the detection is nor- 
mal, i.e., it is not due to the dark counts. We define J' (7 3+/ ) as 
the number of pulses detected normally (by dark counts) un- 
der the condition that the state sent is vacuum (i = 0), single 
photon (; = 1), or multi-photon (i = 2) states. For example, J 3 
represents the number of pulses detected by dark counts when 
the state sent by Alice is the vacuum. We regard the simul- 
taneous event of a dark count and a normal count as a dark 
count. This is because the collision of both photons causes 



the information loss of the normal count. Let t be the num- 
ber of pulses or bits with transmission (phase) error in x basis 
among J 1 bits. This is also a random variable. Then, by de- 
noting the expectation with respect to the random variables t 
andj = (7°, . . . , 7 5 ) by ] 



■'t.r 



P 9 . can be evaluated as 

ph,av,x 



P p <E 9 24 m(£>i ' 2)c) ~ yl/,( ' / - /1) ~- /2 ~- /4 ~- /5 

ph,av,—* ~ /,J,£> e ,POS 



-E 9 



2-[m(», ; lD f )-iV+/ l (l-/i(/// 1 ))+/ +/ 3 ] + 



and 



ph,av,t 



<E- 



P r 

'/,J,» f ,POS z 
- d /,J,D f ,POS 



-[m(X>,,D e )-J l h(t/J l )-f>-J 2 ] 



where [z]+ = max{0,z} and h(x) is defined by 



h(x) : = 



-xlog 2 x-(l -x)log 2 (l -x) if xe [0,1/2] 
1 " ifxe (1/2, 1]. 

(12) 

In the actual system, the random variables t and J cannot be 
identified exactly. They are estimated from the measured val- 
ues D e , by which the size of sacrifice bits m(Dj,D e ) is de- 
termined. It is of crucial importance to determine m(£),, D e ) 
such that the average error probability P 9 h av ( is less than 
a given value for any attack f. The statistical fluctuation 
of T) e is properly taken into account in the computation of 
m{Dj, T>e). As for the attack f, it is sufficient to treat the 
extremal points, in which these random variables can be de- 
scribed by the combination of multi-hypergeometric distribu- 
tions. All random variables concern our problem are listed in 
Sec, E] 



IV. EVE'S STRATEGY AND ITS ESTIMATION 

Suppose that Eve can distinguish the different number 
states. A naive way to describe Eve's attacks is to associate 
each number state with the corresponding parameters describ- 
ing Eve's attacks. This is, however, a formidable task because 
the infinite number of unknown parameters are involved. In 
order to avoid such a difficulty, one of the authors [22] intro- 
duced a convex expansion of the phase-randomized coherent 
state Yi7=o ^//"InXnl/n! in terms of vacuum, single-photon, 
and multi-photon states. Here, we define the multi-photon 
states o~i (I = 2, . . . , k + 1) as 



where 



and 



1 °° 

o-i := — V -y|n><4 



n=l 



l-\ 



,n-2 



Jl 



(13) 



(14) 



(15) 
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with fi\ < fi2 < ■ ■ ■ < fa. Note that 07 [Eq. ( fT3] ll are bona fide 
states, i.e., 07 > and Tro - / = 1. It is easy to see that the state 
Yin=o c _/i /x"|n)(n|/ra! can be expressed as a convex combination 
of |0> <0|, |1> <1 Lander,; 



00 n 

Hi 



= e~* lOXOI+ftllXH + X^n^"^ " '" 
V 

Here, coefficients 



i+1 n-2 



h=2 1=1 



■(16) 



11-2 



are positive. 

Now, we adopt the worst case scenario on Eve's attacks. 
Namely, we assume that Eve can distinguish vacuum state 
(Po = |0}(0|), single photon state (p\ = |1)(1|), multi-photon 
states with x basis pj = crj {j = 2, ...,k + 1) and those 
with + basis pk+j = crj (j = k + 2, . . . , 2k + 1). The num- 
ber of emitted jth state pj (J = 0, . . . , 2k + 1) is denoted by 
E}j; B = (B J ). According to the values of B, Eve can do the 
following attacks; Eve tricks Bob into detecting jth state with 



ratio q J (B) [23] and causes phase errors with ratio r'(B) for 
jth state (J = 1, 2, . . .,k + 1) and bit errors with ratio r'(B) for 
jth state (j - l,k + 2, . . ., 2k + 1). The quantities r j (B) and 
r'(B) describe the transmission errors. In the following, we 
focus on the final secret key of x basis and write q' and r 1 (r- 7 ) 
instead of q j (B) and r j (B) [r J '(B)]. Note that q j is the rate of 
detection with the exclusion of dark counts. Since the state p> 
with the x basis is, in general, different from that with the + 
basis, the parameters q' do not necessarily coincide with q J+k 
(j - l,,,.,k). The generating probability of each state can be 
described by the matrix (P J tj )i=o,...,2kj=o,...,2k+\ defined by 



1 (T 

Y Z X 

Y Z X, 



(17) 



where Y and Z are fc-dimensional vectors such that Y, — e rt 
and Z, = [Xie~ ti > and the k x k matrix X is given by 

X J ._ j P- IXCiG"; - Ude-MQ.j+i j=l,...,i (lg) 
' \ y = 2+l,.. .,k, 

for / = 1 , . . . , k. For example, the matrix for k = 3 is given 
by 



f 1 























0\ 


e'l" p\e~^ e 


^-pkl 2 e 























p2^ 112 e 


^p\{p2 - 


/ii)Q 3 
















p 3 e-^ e 




yUi)C2 3 
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e^< p ie -^ 















e-^pkli 










e^ 1 p 2 e^ 2 















e-^p 2 Jp2 ~ 


p\)Q.-i 






















e^plip-i - 


pi)Q. 3 


*, 


e~^(ji3 -pi)(p 3 


- J"2)^4- 



















Now, the expectation of the detection probability p, = C, /A, 
is expressed as 



2k+\ 



E(pd = Z?\<l)--=YjPiq j +PD, 



(20) 



for i = 0,...,2k and the expectation of detected error proba- 
bility is written as 

k+l . 

Bisipd = H< 2) (q, r) := P\q l r v + l'W' J + ^9° + Pd), 

7=2 

(21) 

for i = 1,2, ...,k, where s ; = HJE, (i + j'q) and s io = 
HJ(E io -N). In Eq. <E), r 1 ' = (1 'PsV + Psd - r 1 ). Since 
we cannot uniquely determine the parameters q' and r 1 from 
Eqs. d20T > and d2TT > even when E(p,) = p, and E(sipi) = Sipi, 
we fix i-tpL and r k+l as x € [0, V2(l - p D )] and y € [0, 1] 



to obtain 



<7i = 



and 



with 



Po-Pd j = 

^ 7= l,...,Jfe,Jk + 2, 



,2fc 



' .r.v 



? j-2 A 

y j = k + i, 



(22) 



(23) 



x ^ SiPi - i[P?(po - Pa) + Pd] " ^ +1 ^ +1 y) .(24) 



5 



where Xm presents the I x I submatrix (.3Qj)i<y</ for a given 
rectangular matrix X = (X,-j)osfea,ft</si>» an d & ' = !>•••> 2fc) 
in Eq. d22l is defined as 



2/< 



2kx.2k) l j 



— —2k+l 
Pi ~Pd- Pi (PO ~ Pd) ~ xP t 



(25) 



When the true values q' and r' are close to zero, say, the 
linear estimators given above often take on negative values 
due to statistical fluctuations. The maximal likelihood estima- 
tion provides an alternate solution free from such a drawback, 
which is given by 



where 



2ft+l 

j'=o 



(26) 



with 



l 

V2 
1 

V2 
1 

V2 



f = k+ l,j = 2k + 1 

/ =2k+l,j = 2k+l 

f = 2k+lork + l,j = k+l 

Othprwisf 



(27) 



l Q ML r ML \ 

[^x.yXBjy x,y,(B\)l 



2k 



argmax I J] [c, log H«(q) + (A; - Q) log(l - Sf>(q))] 

q,r:(j' +1 +g 2t+1 = V3.v,r i+I =v ( i=0 

* ~ (2) (q r) * 

+ 2 H < lo S 7.(1) + X (jB < " 6 ^ N ~ Hi) log 



i=1 



(28) 



with < q J < 1 - po and < r J < 1. If the above linear variables obey 
estimators Eqs. (l22l and d23l ) are in the range < q{ < I - po 
and < ri v < 1, then they coincide with the corresponding 



maximum likelihood estimators. 



V. RANDOM VARIABLES DESCRIBING THE SYSTEM 

To compute the size of final secret key with the finite statis- 
tics due to the finite code length, several stochastic variables 
must be incorporated properly. In this section, we describe 
random variables with their means and (co)variances, which 
are used in the computation of the sacrifice key size (Sec. lVIll i. 

Firstly, we define Bj as the number of the emitted state 
Pj given that the ith kind of pulse is sent (z = 0, . . . , 2k; 
j - 0, ... ,2k + 1). They obey the following multi-nomial 
distribution. 



P{Bl 



Ail 



B" 



■ B 2k+l ! ' 



(29) 



L j= o i 



and B j = ££ B\. The mean of B\ is 



Note that A; 
PjAi. 

Next, we define C\ as the number of /the kind of pulse de- 
tected normally under the condition that the emitted states is 
Pj (i = 0, . . . ,2k; j = 0, . . . ,2k + 1). Note that the dark counts 
are not included in the detection events. The contribution of 
dark counts is expressed as Cr 1 (j = -1). These stochastic 



P(ci,c{,...,ci k ) = 



for j + -1 and 



P{CJ x )=p% (l-p D ) 



At-Cr 



A, 
CT 1 



(30) 



(31) 



Note that ZSo c l = l' ?h=o B i and d = c \- The means 
EC 1 , are given by q'B\ for j ' + -1 and pr>A; for /' = -1. Devi- 
ations A'Cj = Cj - EC/ satisfy 



^'C{A'C{, = q j (l-q j ) 



B j B{ ^ 



SijPUi - 



y2k pj. 



for j + -1 and 



ECA'Cf 1 ) 2 = p D (l - p D )Ai. 



, (32) 



(33) 



Other covariances are zero. 

Since Bob measures the received pulses with randomly cho- 
sen basis, the measuring basis coincides with the basis of pj 
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with probability 1/2 [124]. Therefore, defining the numbers of 



common basis pulses among Cj by E 1 . ■ 
obey the following binomial distribution 



\C J + A'E J , they 



(34) 



for i = 0, 1, . . . , 2k and j = -I, ... ,2k + 1 , and the nonzero 
covariances of A'Ej are computed as 



E(A'£/) 2 = 



1 



k+ 1 



-C = 



fc+ 1 ' 



(35) 



The errors occur among F J . check bits in x basis with prob- 
ability r- ' (J = 1, ...,k+ 1). We define as the num- 
ber of pulses with transmission errors in x basis among F J . 
pulses; Gj = r ] F 1 . + A'Gj, which obey the following multi- 
hypergeometric distribution 

P(Gi,...,Gi,Gi +k ) 

(' )...(' \(' \( \ 

\G>) \G A, ; J\ r i^d,-zft.G J J 



(42) 



for ./' ^ - 1 and 



i(A'£r 1 ) 2 = 



£+ 1 



(36) 



Now we define the following quantities F J . ; (F J . +k ) de- 
notes the number of check bits with x (+) basis within E i(i - N 
(N) bits given that the emitted state is pj and Fj = E 1 . for 
i - I, . . . ,k,i ^ iq. For i = ;'o and i = i'o + £, their distributions 
are, respectively, given by the following multi-hypergeometric 
distributions (J = -1,0, 1, . . .,2k + 1). 



P(FJ\F?,FI ,F 



(f-i)^ )^) )^ ) ' ' ' {pk+i) 

'0 '0 '0 '0 '0 



F°)\F° 



( \ 

\E iB -N) 



(37) 



and 



P(F~ l F° F l F k+2 



io+k' io+k' i'o+£ 7 

/F~ [ \ /F Ki \ /F 1 \ /F k ~ 



io+A:' 



\F7'/\f9 ,Af! J\F t+2 J \F 2k+ }> 

iq+k iQ+k 'Q+k '0+* f + * 

(¥) 



(38) 



where Ej 
Note that 



7*+2 

easy to see that 



Y 2k+1 pj y2*+l F J - p. _ N y2k+l pJ 



N. 



E z 



2k+l 



E 2 



2k+l 

" h+k 
E k+ }, = 0. It is 



EF j = ^ 

'0 F 



N 



in 



E J ., 

'0 



and 



EF>, 

i +k 



N 

?i +k 



E J 

<0+i' 



(39) 



(40) 



for i = 1, . . .,k, i + k and j = 1,2, . . . ,k+ 1. Note that G/ = 
for i > k + 1 and z ^ z'o + and that the system errors other than 
the transmission errors are not counted in the definition of G\. 
The nonzero covariances of deviations A'Gj are computed as 



BA'GjA'Gj, = r>{\ - r J ) 



Si.i'Fi - 



FjFj, 



(43) 



The number of detected errors in x basis Hj is the sum of 
several contributions. The contribution of dark counts (vac- 
uum state) is denoted by H' 1 (Hr), which is the number of 
detected errors of p_i (po) among F7 l (F°) bits. Since the bits 
received by Bob are completely independent of the bits sent 
by Alice for /' = -1 and 0, the error probability is 1/2 so that 
the probability distributions of random the random variables 
H~ l and Hf are, respectively, given by 



(44) 



and 



F" 



F 

H? 



(45) 



For the single photon state, the errors occurred within G, bits 
are recovered accidentally by the system errors other than 
transmission errors with probability p s and that the errors oc- 
curred within Fl - Gj by the same cause contribute to the 
detected errors with probability p$ ■ Therefore, the detected 
errors of the single photon state are divided into two; Hj and 
Hj', whose probability distributions are, respectively, given 
by 



for j = -1, ... ,2k + 1. The nonzero covariances of deviation 
A'F J are computed as 



P{H}) = {\-p s f>p 



Gi-H' 



(46) 



E 



EA F J A F- = — 1 

Ei 



N 



NE 



for i = i ( j 
-1,0,1, k + 2, 



-1,0,1,2,...,*+ 1) and i 
,,2k+ 1). 



(41) 
/o + k (j = 



and 



p(Hj') = pf(i- Ps fhc>-Hy^ 



,IF) - G ) 



H 1 



(47) 
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The random variable //, is then written as 

k+\ 

Hi = h; 1 +h» + h!+h}' +J]gI 

j=2 

= \{FJ X + Ff) + (1 - Ps)G- + ps(Fj - G, 1 ) 

A-+1 
7=2 



(48) 



where A'//, is the deviation whose nonzero variances are given 
by 



1 



E(A H t ) = — (F r' + F") + Ps (l - /> 5 )F/. (49) 
The numbers known by Alice and Bob are C, = 2j=-l Cjf, 

2i+l F j 



= E j for j = 0, 1, . . . , 2fe, and //, for i = 1, . . . , £. 



VI. COMPUTATION OF SACRIFICE KEY SIZE 
(REVERSE CASE) 

In this section, we give a method to derive the size of sac- 
rifice key of + basis in case of reverse error correction. Ac- 
cording to the central limit theorem with respect to the multi- 
nomial and multi-hypergeometric distributions, we can as- 
sume safely that all random variables given in Sec. [V] obey 
normal distributions with the averages and the (co)variances 
given in Sec. [V] because the number of our samples is suffi- 
ciently large. 

In the following argument, stochastic variables Bi are fixed. 
For now, we fix also x — - — ^i±i — W andj = r k+1 (R). Ap- 
plying the inequality ( fTTT ). the quantity P f> h m ^_ is bounded 



from above by the expectation of 



m(Di,D e )-N+F' A 1 



4^ 
l 7 ^ 



Here, J 1 and t in (fTTT i are, respectively, given by Fj +k and 
G. +k . The number of pulses detected by dark counts J 3 + J 4 + 
J 5 in ( fTTT ) is simply expressed as F7^ k . Now, we introduce a 
new function h a (x) which is a slight modification of h(x): 

T t \ if x > a, 

h a (x) - <- -r . (50) 

I h(a) + h (a)(x — a) if x < a. 

Owing to the convexity of h(x), we have h(x) < h a (x) to obtain 



y 7 ^ 



+r- 



< 2 



m(O h D e )-N+F) n+ \ l-h a \ -^i | |+F 



i +k 



which is used for an upper bound of the quantity P p 
Here, we estimate 



&(Di,D e ) : = N - F 



h+k 



<G l ^ 
F 1 

K i +k ) 



-F 



io+k' 



(51) 
(52) 



by the estimator [25J 



® x , y (Vi, D e ) :=N- ft x Pl +k [l - h a cO] + Pd\ ■ 

(53) 

The deviation ©(£),, £> e ) - &. ( , y (Di,D e ) is divided into two 
stochastic variables, A©; and A0 2 ; 



©(£>„£>,) - ©,, v (£>„£> c ) = A0! + A0 2 , 



(54) 



where 



A0, 



i +k 



I -h a 



T io+k 



F 1 

V i a +k) 



f; 



i +k 



and 



A0 2 := 



N{qlBl +k [l-h a (fl^]+A k+kPD } 

Cio+k 

Nql(A i0+k Pl +k -Bl +k )[l-h a (f{ y )] 



Ci 



(55) 



(56) 



io+k 



Now, let us apply the Gaussian approximation to the vari- 
ables A0i and A©2. Since the mean of A©i is zero, 

A /v Vtv (q,r,Z?/,A,/i)0- 1 (2-' 5 ') > A©,, (57) 

with probability > 1 - 2~ S K Here, v,- . vy (q, r, Bj, A,fi) denotes 
the variance of AQi, and 



<D(a 



i r~ x -i 

x) = — — e 2 

V27T J-co 



dy 



(58) 



is the probabilistic distribution of the standard normal distri- 
bution. In Eq. d56l ). Ai 0+ kP) a+k - & +k is a stochastic variable 
with the mean zero and the variance Ai 0+k P^ +k (l - F4 +Jt ). It 
follows that 

Nq\[\ -h a {rl y )} 



C 



io+k 



(59) 

with probability > 1 - 2~ Sl . Consequently, taking the size of 
privacy amplification m(0;, D e ) in ( fTTT i as 



m(Di,D e ) = & x , y (Di,D e ) + A /v, 0; , v (q,r,Bf,A,/<)(D- 1 (2-' 5 ') 
Nq x x [\-h a (rl y j\ 



C 



io+k 



we have 



ph,av,t 



< 2~° l + 2~" 2 + 2 



S3 



(60) 



(61) 



The quantity m(£),, D e ) [Eq. ( l60l ll depends on q, r, and B J r 
which can be approximated by a ML , , r ML . , and A;P J , re- 

spectively so that m(T>,, D e ) can be written in terms of ob- 
served quantities. From above observation, we define the size 
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of privacy amplification for fixed x and y as 

m k ., x , y (Di,D e ) 

+ ^ /v, . rv (q ML , ,r ML . ,A,P j .,A,n)®- 1 (2~ Sl ) 
Nq\[\-h a (fl y )\ 



Q 



k+k 



+6 3 , 
which satisfies 



.JD h D e ) >©(£>,,£>,) + 6 3 



(62) 



(63) 



with probability 1 - 2~ s ' - 2^-. It should be noted that the 
linear estimators at and r J. ,, are used in the first term of the 

* 

right-hand side of Eq. dbZ} , while the maximally likelihood 
estimators are used in the second and third terms. This is be- 
cause if linear estimators were used in the second and third 
terms in the right-hand side of Eq. d62t . these terms would 
not well-defined since the linear estimators do not necessarily 
satisfy < qi < I - po and < f{ r < 1. 

Now, we take the worst case and define the size of privacy 
amplification m^'Di, D e ) as 



m, (£>,,£>,):= 



0<jc< V2(l-p D ),0<;y<l 



m k . x , y (DuD e ), 



(64) 



then doTt holds for arbitrary x and y [26]. 

The size of privacy amplification for x basis is given by 
m io (A,n, p s , p D \C,E,H) where Aq = A , A,- = A t + k , A i+k = 
Aj, Co = Cq, Cj = Ci+k, Cj+k - Cj, Eq = Eq, % = E i+k , 
E i+k = E h Hi = H i+k , and H i+k = H t for 2 = 1,... ,k. 

In the course of actual numerical computations, it often 
happens that x or y moves away from its defining region. To 
circumvent this difficulty, we use h a (z) instead of h(z), which 
enables us to extend the accessible region of z to (-oo, oo) and 
further to avoid the divergence of the derivative of h. When 
a is small enough, v; . tv (q, r, Bj, A,fi) takes on a large value, 
while a is large, AiV (£),, D e ) takes on a large value in turn. 
The parameter a must be properly chosen taking into account 
such a trade-off behavior. The detail is shown in AppendixlAl 

Now, let us go back to Eq. (0|. To ensure 



f 



< 2~ 



(65) 



it is sufficient to choose 6i = 6 + 6' + 1 and 62 = 63 = 6 + 6' + 2. 
Here, 6' is [log 2 n\ Since 6 + 6' <^N, 6 + 6' + 1 +N < 2 s ' . 
Thus, 



< P 



ip 



a+N-io g p; Kav ^) 



ph,av 

< 2~ s - s \\ + N + 6 + 6') 

< 2~ s ~ 6 ' ■ 2 s ' = 2~ s . 



(66) 



In parallel with the above argument based on the Gaussian 
approximation, the large deviation type evaluation is also pos- 
sible. By Cramer's theorem JH], Prob{|X - E(X)\ > cN) goes 



to zero exponentially when X obeys the N trials of a multino- 
mial distribution or a multinomial hypergeometric distribution 
for an arbitrary constant c > 0. Hence, the probability satisfy- 
ing the inequalities 



io+k 



c 3 N, and AFr 1 . 

'o+k 



A0 2 < ciN, 
■E(Fj o+k )<c 2 N,AGl +k 

r i +k 



(67) 
•E(G,U)< 

- E(f \ J^) < C4N goes to zero ex- 



G) 



k+k 



ponentially for arbitrary constants c\,C2, C3,q > 0. For an 
arbitrary constant C5 > 0, we choose 02,03,04 > such that if 
< NC2, AG\ +k < No 3 , A, and AFr^ < No 4 , then 

A0i < c 5 N (68) 

is always satisfied. Thus, the probability satisfying d68l l goes 
to zero exponentially. Now, we denote the exponential upper 
bounds of d67| i and d68l > by 2~ d[N and 2~ dlN , respectively, and 
choose the size of sacrifice bits mj o:x y (!Di, D e ) as E@ + (c\ + 
c$+C(,)N for a constant C(, > 0. Then, applying (fTTb . we obtain 
an exponential upper bound: 

P9 ph,av^ ^ ^ + ^ + TC " N - ( 69 ) 

However, as is known in mathematical statistics, the above 
exponential evaluation does not yield a tighter upper bound of 
Prob{|X - E(X)\ > cN) as the Gaussian approximation does. 
Hence, in the finite-length code, the Gaussian approximation 
gives a tighter upper bound of P ph av ^_ than the above expo- 
nential upper bound. This is the reason why we have em- 
ployed the Gaussian approximation. 

VII. COMPUTATION OF v io (q, r, B\, A, fi) 

The variance v, 0;t ,,(q, r, B 1 ., A,//) for a given stochastic vari- 
and under constraints - — % — = x and r — y is 

(70) 



able B\ 
given by 



v !0w (q,r,sf,A,/i)=EA©2, 



where 

A0! 

a - [l - Mr 1 )] AFl +k + ~h a {r l )A' G) g+k - AFT\ 
N{q l Bi +k [l-h a (r l )] + A i0+kPD } ^ 

(EC i0+k ) 2 k+k 
,[l-h a {r x )] 



+k 



1 yA^--—q'Bl +k h a (r')Af{ r 

^•^ia+k 



ECj 0+k 



(71) 



with AX = X - EX in the right-hand side of Eq. (EB- Here, 
stochastic variables, AF. ,,, AFr' , Aq\, and Af\„ are com- 
puted as 

2Nq j B j ., 2 *±i 



Ap j s 2N AE j 1 ' 0+ 

'o + * EC iB+k '° + * (EC, 0+i ) : . 



+A'F i . 



•o+k 
k+k' 



(72) 
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, ^ — i ,/ACi -oAC \ and 
A^ = ^(/> 2tx2 ,) ! 1 ^-P i -^j, (73) 



1 



(l-2^)(§i) 2 f 



* r i 

2(^)i|Ete)-- 



(1 



(74) 



In Eq. ( |74| ). Aq 1 ^ 1 and A{s/pi) are given by 



TABLE I: Parameters for numerical simulation. 



2 2EH,- , 

A(s,-b/) ss — Ai/, - — — -A'£ ; , 



(76) 



for i = 1 , . . . , k; i io and 

ECi, 



A(*ioPio) = 



A, (E£ io -A0 
NEH in 



EC in EH in 
10 A /o (E£ /0 -A0 2 ° 



o-AC, . 



A io (E£< -A0 2 
Deviations A//, in Eqs. (l76l l and (ITTT i are computed as 



(77) 



it+i 



Ai/,- = ^ -AC/ + Y r'A'Z?/ + (1 - Zp^A'G, 1 

;=-i j=-i 

+ ^ A'Gj + A' H h 

j=2 



(78) 



for i — 1, . . . , £; i ' + i'o. and 

£+1 



AH, V 



- 2> 

j=-i 



2NEC 1 

+ £ V A£ J +A'F 7 

(EC, ) 2 f-< 



/=-! 



+(1 - 2 P s)A'G{ + J] A'Gj + A'H k , (79) 

where r _1 = r° = 5, r 1 = r l + (1 - 2r l )p$, and = r' for 

j > 2. Note that AE\ = \KC\ + A! E J . in Eqs. 473]) and djl. 
Equation ( TTOb with subsequent equations in this section and 
(co)variances given in Sec.[V]yields the explicit form of v, l . 

If q and r coincide with the respective values estimated 
from the observed quantities D e = (C, E, H), EC;, EEi , and 
EHj in Eqs. (|7TJ, C72]i, {76]), and (77]) are, respectively, equal 
to the observed quantities, C;, .£,■„, and //,. 



«i (db/km) ao (db) 


Idet 


0.17 5.0 


0.1 


Pd Ps , Ps 


Po 


4.0 x 10~ 7 3% 


4.0 x 10~ 7 



VIII. NUMERICAL ANALYSIS 

In this section we show the results of numerical simulation 
to reveal performances of our protocol and to know the op- 
timal values of parameters such as intensities in our protocol. 
For numerical simulation, we use k+ 1 = 4 different intensities 
including vacuum because k — 3 is required for at least good 
estimation of the probability that multi-photon is actually sent 
by Alice Q. 



A. Parameters 

Let a\ (db/km) be the fiber loss, ao (db) be the receiver 
loss, rjdet be the efficiency of the detector, and L (km) be the 
transmission distance. A detection probability p of the pulse 
p, can be represented by 



1 



-a i.t, 



+ Po, 



where 



a = TJdet ■ 10 



(80) 



(81) 



Listed in Table U are parameters used for our numerical sim- 
ulation, all of which are experimental values in the long dis- 
tance experiment 12811 . and a\ is the lowest loss value in com- 
mercially available optical fibers l29ll . We assume that the 
detection probability po of vacuum state equals to dark count 
rate po- In this setting, the detection probability of the pulse 
p = 0.5 at L = 20.0(100.0) (km) is 7.2 x 10" 3 (3.2 x 10~ 3 ) and 
the error probability is 3.00%(3.06%), respectively. 

We also fix the security parameter 5 in order to satisfy the 
average of Eve's information 7? 



< 2- 9 in Eq. ([63. It 
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Shannon limit 
LDPC code (N=1 ,000,000) 
LDPC code (N=1 00,000) 
LDPC code (N=1 0,000) 




0.05 0.06 0.07 

error probability 



FIG. 1 : Coding rates of the LDPC codes used for numerical simula- 
tion. 



is sufficient to set 6\ — £3 = 9 + [log 2 (A0] + 2, and 62 = 
9 + [log 2 (3V)] + l. 

For the error correction with the finite code len gth, we use 
the LDPC (Low Density Parity Check) code JM1H which 
is known to be one of the best classical error correcting codes 
and the performance can asymptotically achieve the Shannon 
limit. Figure Q] shows coding rates of our LDPC codes. The 
coding rate with N - 1.0 x 10 6 is about 0.75 when the error 
probability is 3%. 

Suppose that intensities /i,- and sending probabilities p, take 
discrete values 0.05, 0. 10, . . . , 1 .00 for our numerical simula- 
tion because computation of m, o; , ;,y(£>u 'De) d62l needs a con- 
strained non-linear optimization and it is therefore rather hard 
and time-consuming task. 
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FIG. 2: Performance of our decoy state QKD. The secure secret key 
can be shared up to 150 km when N = 1.0 x 10 6 . 
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asymptotic rate (signal pulse) 



/j 3 (signal pulse) 
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FIG. 3: Optimal intensities with N = 1.0 x 10 6 and the asymptotic 
case corresponding to the key generation rates in Figure[2] 



B. Performance 

We first show key generation rates of our protocol with re- 
spect to the transmission distance. Figure[2]shows the optimal 
key generation rates per pulse sent by Alice when the code 
length N equals to 1 .0 x 10 4 , 1 .0 x 10 s , and 1 .0 x 10 6 , keeping 
the average of Eve's information less than 2~ 9 . For compar- 
ison, the asymptotic rate is also added, which is calculated 
from the asymptotic rate formula with three different inten- 
sities including vacuum B22I1 . Our decoy state QKD enables 
Alice and Bob to share the final secret key securely up to 150 
(km) while the secure secret key can be shared up to 250 (km) 
in the asymptotic case. Although there is a huge gap between 
the maximum transmission distances of the finite and asymp- 
totic case, such small key generation rate with the finite code 
length, in other words the large number of sacrifice bits, is 
needed for keeping the average of Eve's information less than 
2~ 9 incorporating the statistical fluctuations. The main reason 



why the more key generation rate is obtained with larger code 
size is that Eve's information can be estimated better with 
large size statistics, such that the larger number of sampling 
given by the check bits can be used for estimation as well as 
the finite error correcting coding rate in Figure Q] 

We then show the optimal intensities corresponding to the 
rates in Figure [2] The three optimal different intensities /i,- 
with N - 1 .Ox 10 6 as well as the signal intensity in the asymp- 
totic case are shown in Figure|3] The optimal signal intensities 
decrease as the transmission distance is longer. This tendency 
is easy to understood because the probability that the multi- 
photon is emitted cannot be negligible for estimation of the 
quantum channel at the long transmission distance. At the 
maximum transmission distance 150 (km), The optimal inten- 
sity //3 becomes 0.15 which is the minimum value of the signal 
intensity available for our numerical simulation because inten- 
sities fi, take discrete values by 0.05 and < /-ii < fi2 < Mi- 
lt is quite smaller than the intensity 0.3 of the asymptotic case 
at the maximal transmission distance 250 (km). This is be- 
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■N= 1,000,000 
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■N=1 0,000 
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FIG. 4: Key generation rates with respect to the security parameter 6 
when the code length N = 10 4 , 10 5 , and 10 6 . 



cause considering statistical fluctuations including estimation 
errors causes the worse estimations of m, o;A%v (£),, T> e ) and such 
random variables as J than the true values without estimation 
errors. It turns out that the probability that the multi-photon is 
sent including statistical fluctuations becomes more dominant 
factor in our protocol. 

We finally examine the performance of our protocol with 
respect to the security parameter 6. Figure [4] shows the key 
generation rates at the transmission distance 20 (km). The 
rates when N = 1 .0 x 10 6 hardly decrease at all while the rates 
when N = 1.0 x 10 4 and 1.0 x 10 5 become smaller as 6 is 
bigger. This is because the larger number of sampling when 
N is large enough makes the variance Vj in Eq d62l smaller. 
Therefore the size of sacrifice bits m^JJDi, D e ) is affected 
little by 8\, that is 6, and the final secret key can be shared as 
securely as you want when N = 1.0 x 10 6 . 



IX. CONCLUSIONS AND FUTURE PERSPECTIVES 

In conclusion, we have derived a formula for the size the 
final secret key in the finite code length decoy state QKD with 
arbitrary number of decoy states of different intensities incor- 
porating the finite statistics l32ll . 

We have utilized the central limit theorem and thereby ne- 
glected the higher-order terms in the formula obtained here. 
Furthermore, there is room to improve the derivation of the 
size of privacy amplification. These points will be further 
pursued in the future. Finally, we have assumed that the er- 
ror probability of the signal generation at the sending port is 
unknown. If this is not the case, th e g eneration rate of the 
final secret key would be improved IB3I1 . Such an improve- 
ment of arguments in Sec. [VI] would be also one of the future 
problems. 



APPENDIX A: CHOICE OF PARAMETER a 

In Sec.[Vl]we have used h a (x) instead of h(x) to circumvent 
the singularity of h(x) when x — > 0. If x is so close to that 
h a (x) » h a (x), the leading term of A0i is well approximated 
by 

Hence, denoting the variance of 

N 



A'G) 



EC, 



i +k 



SK+kKy 



by V, we have 

»<,:,,. in. n> 

s N 



NA io+k (q\P) o+k +p D ) ^ 



c, 



k+k 



(Al) 



Our task is to choose the parameter a that minimizes 
mfcxyfJDi, !D e ); the problem is reduced to the minimization of 

f(a) - h a (r l XJ )S + h a {j\y)T with respect to a, where 

Us(r-a) + T W '(a) r^>a, 
{ f\ y <a, 



S := 



and 



C, 



ki+k 



T := VV<D" 1 (2" <52 ). 



(A3) 
(A4) 



Since h"(a) < 0, the minimal f(a) is achieved when a = 
r\ x + T IS . The values of S and T are actually unknown and 
vary from time to time. However, if we can expect almost con- 
stant values for S and T, which can be measured in advance, 
a favorable choice of a is a = r\ + T/S . 



APPENDIX B: COMPUTATION OF SACRIFICE KEY SIZE 
(FORWARD CASE) 

To compute the size of sacrifice bits in the case of for- 
ward error correction, we firstly change the definitions of ran- 
dom variables in Sec. [Ill] since J 3 in Eq. ( fTOb cannot be ex- 
pressed in terms of them with their original definitions. Ma- 
jor alteration concerns the definition of the subscript j: For 
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j = 0,2, ...,2k + I, q* are changed to represent the detection 
ratio including the detector dark counts and q~ l is changed 
to stand for the dark count ratio given that the emitted state 
is a single photon state {q l is left unchanged). Namely, for 
j = 0,2, ... ,2k + 1, Cj now denote the numbers of pulses 
detected normally as well as by dark counts given that the 
emitted state is pj and CJ X now stands for the number of dark 
counts given that the emitted state is p\. Alongside the mean- 
ing of r' is changed for j = 2,...,k+ 1. According to these 
alterations, the definition of random variables E J ., F J r G\, and 
Hi are also subject to modification. Almost all of equations 
in Sec. [IV] and Sec. [V] are left unchanged except that (i) po 
should read poP] ■ (ii) the range of q' (j = 2,..., 2k) should 
be changed to < q J < 1. (iii) the range of x should be 
changed to [1, a/2], and (iv) Eqs. (|22), (|24), and (|25j should 
read, respectively, 



and 



2* 

1 ,■ / —0 —1 — 2k+\\ 

f == 2jtfW} [Pi ~ Pi Po - Pi Pd - xP, ) . (B3) 

1=1 



The upper bound for the average phase error is now given 



by 



m-N+Fi.M-. 



Here, we use 



-r'> 



Po .1 
? j 





l,...,k,k + 2, 
k+ 1 
2k + I, 



..,2k 



(Bl) 



N- 



NA 



C 



io+k 



as the estimation of 



s iPi --(P iP o + P)PD)-P\ +l q k : x y 



N-F, 



i +k 



l-h 



°io+k 

F l 

V i +k J 



io+k' 



(B2) The subsequent argument is parallel to that in Sec. lVIl 



[1] C. H. Bennett and G. Brassard, in Proceedings of IEEE Inter- 
national Conference on Computers, Systems, and Signal Pro- 
cessing, Bangalore, India, 1984 (IEEE, New York, 1984), p. 
175. 

[2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. 

Phys. 74, 145 (2002). 
[3] D. Mayers, in Advances in Crytology — Proceedings of Crypto 

'96; Lecture Notes in Computer Science, 1109, 343 (1996); J. 

ACM 48, 351 (2001). 
[4] H.-K. Lo and H. F. Chau, Science 283, 2050 (1999); P. W. Shor 

and J. Preskill, Phys. Rev. L ett. 85 411 ( 2000); H. Inamori, N. 

Lutkenhaus, and D. Mayers, quant-ph/0 107017] 

[5] H. Inamori, N. Lutkenhaus, and D. Mayers, quant-ph/0 1070 17 
[6] M. A. Nielsen and I. L. Chuang, Quantum Computation 

and Quantum Information (Cambridge University Press, Cam- 
bridge, United Kingdom, 2000). 
[7] M. Hayashi, Quantum Information: An Introduction (Springer- 

Verlag, Berlin, 2006). 
[8] B. Huttner, N. Imoto, N. Gisin, and T. Mor, Phys. Rev. A 

51, 1863 (1995); G. Brassard, N. Lutkenhaus, T. Mor, and B. 

Sanders, Phys. Rev. Lett. 85, 1330 (2000); N. Lutkenhaus and 

M. Jahma, New J. Phys. 4 44 (2002). 
[9] D. Gottesman, H.-K. Lo, N. Lutkenhaus, and J. Preskill, Quan- 
tum Inf. Comput. 4, 325 (2004). 
[10] W.-Y. Hwang, Phys. Rev. Lett. 91 057901 (2003). 
[11] X.-B. Wang, Phys. Rev. A 72 012322 (2005); Phys. Rev. Lett. 

94 230503 (2005). 
[12] H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94 230504 



(2005). 

[13] X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, Phys. Rev. A 72, 012326 
(2005); X. Ma, C.-Z. F. Fung, F. Dupuis, K. Chen, K. Tamaki, 
and H.-K. Lo, ibid. 74 032330 (2006). 

[14] Y. Zhao, B. Qi, X. Ma, H.-K. Lo, and L. Qian, Phys. Rev. Lett. 
96 070502 (2006). 

[15] D. Rosenberg, J. W. Harrington, P. R. Rice, P. A. Hiskett, C. 

G. Peterson, R. J. Hughes, A. E. Lita, S. W. Nam, and J. E. 
Nordholt, Phys. Rev. Lett. 98 010503 (2007). 

[16] T. Schmitt-Manderbach, H. Weier, M. Fiirst, R. Ursin, F. 
Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, 
J. G. Rarity, A. Zeilinger, and H. Weinfurter, Phys. Rev. Lett. 
98 010504(2007). 

[17] C.-Z. Peng, J. Zhang, D. Yang, W.-B. Gao, H.-X. Ma, H. Yin, 

H. -P. Zeng, T. Yang, X.-W. Wang, and J.-W. Pan, Phys. Rev. 
Lett. 98 010505 (2007). 

[18] Z. L. Yuan, A. W. Sharpe, and A. J. Shields, Appl. Phys. Lett. 
90 011118 (2007). 

[19] M. Hayashi, Phys. Rev. A 74, 022307 (2006). 

[20] J. W. Harrington, J. M. Ettinger, R. J. Hughes, and J. E. Nord- 
holt, [qi^nt-ph/0503002] 

[21] M. Hayashi, "Upper bounds of security parameters in finite- 
length code with decoy method," Phys. Rev. A, to appear; 
|quant-ph/0702250| 

[22] M. Hayashi, "Asymptotic key generation rates with 
phase-randomized coherent light by decoy method," 
|quant-ph/0702251| 

[23] More generally, Eve can choose g(B)' stochastically according 



13 



to the value of B. Such an operation can be regarded as the prob- 
abilistic mixture of the cases when q(B) j is chosen determinis- 
tically. However, it is sufficient to consider Eve's operation in 
an extremal point for the security arguments l2lh . 

[24] The state p_! is regarded as the pulse detected by dark counts. 

[25] We adopt the linear estimator here. Otherwise if we adopted the 
maximal likelihood estimator, the computation of variance V; . 
would be intractable. 

[26] If the light source is unstable, for example, the values of Bj 
may move somewhat away from the ideal values AiPj f34ll35ll . 
In this case, m, o;vv (D,, D e ) should be replaced by 

N , jV {g' g ,U ^^'..v)- 1 ]- A -°^} 

Suppose B belongs to the set X with probability 1 - e. Then, if 
we define the size of privacy amplification m' jg (Dj,!D e ) as 

<(£),,£).) = max nL D h £),), 

BeX,0<x< V5(l-p D ),0<><! 



we have from Qj}, P r ph m _ ^ e + 2 _<S| + 2^ . 

[27] J. A. Bucklew, Large Deviation Techniques in Decision, Simu- 
lation, and Estimation (Wiley, New York, 1990). 

[28] T. Kimura, Y. Nambu, T. Hatanaka, A. Tomita, H. Kosaka, and 
K. Nakamura, Japanese Journal of Applied Physics 43, 9A/B, 
p.p. 1217-1219 (2004). 

[29] http : //www . corning . com/optical fiber/ 

products__applications/products/smf_28_ULL . aspx, 
http : //www . sei . co . jp/fbr-opt-eng/ submarine/ 
zplus/ pdf / zplus 1 . pdf . 

[30] R. G. Gallager, Low-Density Parity-Check Codes (MIT Press, 
Cambridge, MA, 1963). 

[31] D. J. C. MacKay, in Proceedings of IEEE Transactions on In- 
formation Theory, 45 (2), p.p. 399-431 (1999). 

[32] Since any photon states can be expanded in terms of coherent 
states, the formalism presented in this paper is still valid for any 
distributions of photons from the light source by changing the 
generating probability matices [Eq. | |17H appropriately. 

[33] R. Renner, N. Gisin, and B. Kraus, Phys. Rev. A 72, 012332 
(2005). 

[34] X.-B. Wang, Phys. Rev A. 75, 012301 (2007). 
[35] X.-B. Wang, C.-Z. Peng, and J.-W. Pan, Appl. Phys. Lett. 90, 
031110 (2007). 



